Security Intermediate

What is Rate Limiting?

A technique that controls the number of requests a client can make to a server within a specified time period.

Rate limiting protects APIs and services from abuse, DDoS attacks, and excessive usage. Common approaches include fixed window (X requests per minute), sliding window (smoother distribution), and token bucket (burst-friendly) algorithms.

Implementation can be per-user, per-IP, or per-API-key. HTTP response headers (X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After) communicate limits to clients. Redis is commonly used to track request counts.

Learn More About This Topic

Linux Firewall Configuration

Related reading

Network Security Fundamentals

Related reading

Security+ Certification Guide

Related reading

Related Terms

JWT (JSON Web Token)

A compact, self-contained token format used for securely transmitting information between parties as a JSON object.

An authorization framework that allows third-party applications to access user resources without sharing passwords.

DAST (Dynamic Application Security Testing)

Testing a running application from the outside by sending malicious requests to discover security vulnerabilities.

Content Security Policy (CSP)

An HTTP security header that controls which resources a browser is allowed to load for a web page, preventing XSS and data injection.

A social engineering attack that uses fraudulent communications to trick people into revealing sensitive information or installing malware.

Two-Factor Authentication (2FA)

A security method requiring two different forms of identification before granting access to an account.

View All Security Terms →